First Time Users Configuration Questions Regarding Forwarding

[wdc]

I've found how to get data from a remote users Security Log but we are after a centralised area to keep these logs. I then set the Splunk server to become a receiver and then a test server as a light forwarder. How do I know that it is working? Presumably this data is then stored on the Splunk server somewhere? Is this the best way to get my centralised data?

[Genti]

Did you set the light forwarder to monitor anything on the "forwarding machine"? Did you set the light forwarder to send data to the indexer on some specific port? Did you set up the indexer to listen to the above port?

If so, then just logging in to you indexer should be enough to tell you that you are receiving data..

Assuming you are on unix, a cool command to tell you if you are listening on the indexer is netstat -an | grep 9997 where 9997 is the specific port where you are telling the indexer to listen.

[Genti]

eek, Mick beat me to it..

[Mick]

You'll know its working if you can search on your 'receiving' server and see data that came from your 'forwarding' server. The data should be getting indexed on the receiver, by default it will write to C:\Program Files\Splunk\var\lib\splunk\defaultdb, and in the search summary interface you should see your forwarding server listed on the list of 'Hosts' on the right-hand side.

Yes, this is the recommended solution for getting your logs into a centralized location. There are other ways to implement this, but to keep it straightforward to start with, use a Splunk instance configured as a forwarder.